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RECEIVED 
CENTRAL FAX CENTER 

DEC 1 5 t PATENTS 
IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



Art Unit: 2122 
Confirmation No.: 8243 
Examiner: Kiss,E. 



In re Application of: 
Peter A. J. Van Der Made 
Serial No. 09/642,625 
Filed: August 18,2000 

For. Computer Immune System and Method 
for Detecting Unwanted Code in a 
Computer System 

STATEMENT OF SUBSTANCE OF TELEPHONE INTERVIEW CONDUCTED ON 
NOVEMBER 2, 2004 PURSUANT TO MPEP § 713,01 and 37 CF,R- § 1.33(b) 



Mail Stop Amendment 

Commissioner for Patents December 1 5, 2004 

P.O. Box 1450 
Alexandria, VA 223 13-1450 

Responsive to the Interview Summary mailed on November 19, 2004, the Applicant 
submits the following remarks for the Examiner's consideration. The Applicant notes that the 
response filed on November 1 1, 2004 contains an interview summary as required by 37 CF.R. § 
1 .133(b). As a courtesy, the Applicant has provided another copy of that summary listed below. 
Additionally, the Applicant submits supplemental remarks in response to some points raised by 
the Examiner* Interview Summary. 

Applicant Summary of Telephonic Interview of Novembe r 2, 2004 

The Applicant and the undersigned thank the Examiner for his time and consideration 
given during the telephonic interview of November 2, 2004. During this telephonic interview, a 
proposed amendment to the claims was discussed The Applicant provided the proposed 

I hereby certify that this correspondence is being facsimile transmitted to: Mail Stop Amendment, 
Commissioner for Patents, , P.O. Box 1450, Alexandria, VA 22313-1450, Attn: Examiner Kiss, GAU 
2122, Facsimile No. (703) 872-9306, on December 15, 2004. 
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Application Serial No. 09/642,625 

amendment to the claims in advance of the interview and in connection with an Applicant 
Initiated Interview Request Form submitted by the Applicant on October 25, 2004, 

Examiner Kiss provided his thoughts on the proposed changes to the claims. The 
Examiner stated that he did not believe that the 1997 article entitled Understanding Heuristics: 
Symantec's Bloodhound Technology" (hereinafter, the "UHSBT reference") provides any 
teaching of generating a behavior pattern for the target program by tracking functions performed 
and not performed by the target program with flags in a behavior pattern field and by tracking a 
sequence in which the fiinctions are called by the target program with the behavior pattern field, 
as was provided in proposed amended independent Claim 11. The undersigned agreed with the 
Examiner that the UHSBT reference does not provide any discussion of how it tracks behaviors 
of target programs. 

In the proposed amendment submitted on October 25, 2004 to the Examiner, only 
independent Claims 11, 20, and 26 included the language describing how a behavior pattern is 
generated with a behavior pattern field. The Examiner and undersigned agreed to amend each of 
the independent claims to include the language describing the behavior pattern as this feature 
was not taught by the UHSBT reference. The Examiner stated that while the UHSBT reference 
does not appear to teach the generation of a behavior pattern as claimed, the Examiner indicated 
that he would need to conduct an update search before any final decision is made with respect to 
the claims. 

The Applicant and the undersigned request the Examiner to review this interview 
summary and to approve it by writing "Interview Record OK" along with his initials and the date 
next to this summary in the margin as discussed in MPEP § 713.04, p* 700-202. 

Response to Examiner's Request for Clarification 
as Mentioned in Examiner's Interview Summary 

The Examiner requested Applicant's representative to check the application for support 
of the amendments made to the claims. Specifically, the Examiner invited clarification as to 
whether the new limitations added to the claims suggest that sequence information is stored 
within the behavior pattern field. 

The Applicant notes that page 23, lines 1-10 describe a behavior pattern field (Tstruct) 
that sets flags as the functions represented by those flags are virtualized. The sequence in which 
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these functions are called is recorded in a sequencer. In light of these teachings, it is believed 
that the behavior pattern field tracks functions performed and not performed by the target 
program as well as the sequence of the functions performed. In other words, the behavior pattern 
field provides sequence information to the sequencer and therefore, the behavior pattern 
performs the function of tracking the sequence in which functions are called by the target 
program. 

If the Examiner has any questions regarding these remarks, he is invited to contact the 
undersigned by telephone. 



The foregoing is submitted as a full and complete response Examiner Interview Summary 
mailed on November 19, 2004. The Applicant and the undersigned thank Examiner Kiss for 
consideration of these remarks and interview summary. The Applicant respectfully submits that 
the present application is in condition for allowance. Such action is hereby courteously solicited. 

If the Examiner believes that there are any issues that can be resolved by a telephone 
conference, or that there are any formalities that can be corrected by an Examiner's amendment, 
please contact the undersigned in the Atlanta Metropolitan area (404) 572-2884, 



King & Spalding LLP 
191 Peachtree Street, N-E. 
Atlanta, Georgia 30303-1763 
telephone: (404) 572.4600 
K&S File No. 05456-105041 
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CONCLUSION 



Respectfully submitted, 
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